The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it takes untrusted user data and interpolates it into Python source code for execution without sanitization.
Ingestion points: The workflow in SKILL.md (Step 4) instructs the agent to receive data (numbers, arrays, or CSV) and substitute it into the data area of scripts in the scripts/ directory.
Boundary markers: There are no boundary markers or delimiters defined to separate user-provided data from the executable code within the templates.
Capability inventory: The skill workflow (Step 5) requires the agent to run the modified scripts using python3 scripts/<script>.py via a shell command.
Sanitization: The instructions do not provide any guidance on escaping, validating, or filtering user-provided strings before they are written into the .py files.
[DYNAMIC_EXECUTION]: The skill utilizes a dynamic execution pattern where it generates (or modifies) and executes scripts at runtime.
Evidence: SKILL.md workflow Step 4 ("复制对应 scripts/.py，替换数据区") and Step 5 ("运行：python3 scripts/.py"). While it uses local templates, the incorporation of external input into the execution path is a security risk.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands (python3) to perform its primary function, which, when combined with the lack of input sanitization, poses a risk of command injection if the agent naively interpolates user strings into the script files.

plot-from-data